Pillow, a widely used Python imaging library, is vulnerable to argument injection when it processes EPS files from version 2.6.0 until 13.0.0. The EpsImagePlugin calls Ghostscript, passing a caller-controlled filename directly after the -f option without sanitizing the value. If the filename begins with a hyphen, Ghostscript interprets it as an option and can execute arbitrary switches. By providing a filename that starts with a leading @ and a text file containing additional Ghostscript arguments, an attacker can cause Ghostscript to run arbitrary commands. The exploit chain works even under the default -dSAFER invocation, which normally restricts Ghostscript from opening files. The result is a full remote code execution on the system that runs Pillow.

The vulnerability affects all Pillow versions from 2.6.0 through 13.0.0, inclusive. Any Python project that imports Pillow and processes EPS images with the EpsImagePlugin is impacted. The issue was resolved in Pillow 13.0.0 and newer; upgrades to that version or later provide the necessary filename sanitization.

The CVSS score of 9.2 classifies the issue as critical. The EPSS score is not available, so the realistic exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Based on the description the likely attack vector is the submission or upload of a malicious EPS file containing a specially crafted filename and an @ argument file to the application. The attacker must have write access to the file system where Pillow is executed or be able to supply files to the application, so exploitation is expected to be limited to scenarios handling untrusted file uploads or inputs. Nevertheless, since the exploit succeeds under Ghostscript's default safe mode, any application that uses Pillow for EPS processing remains at significant risk until patched.